CISCO ASA 5520:老革命遇到不可思議的問題

公司要和本地的廣電公司進(jìn)行業(yè)務(wù)合作。為此我們拉了一條100Mb的光纖專線。在此專線的我們這側(cè)，設(shè)計(jì)要上一臺(tái)cisco ASA 5520防火墻。這個(gè)設(shè)備比較普遍。用的比較多。只是有點(diǎn)時(shí)間沒有動(dòng)手配置了。網(wǎng)絡(luò)結(jié)構(gòu)大概如下：

要求：網(wǎng)絡(luò)調(diào)通，讓我們公司內(nèi)部的服務(wù)器可以訪問廣電網(wǎng)。

本來應(yīng)該很簡單的事情?？赡苡捎谔倥渲昧?。根據(jù)記憶配置cisco ASA 5520，竟然不通！天理何在啊！

cisco asa 5520配置：#這列出我自己的配置，默認(rèn)配置不寫。

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address 172.31.87.130 255.255.255.192

!

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 172.18.20.1 255.255.255.0

global (outside) 1 interface

nat (inside) 1 172.18.0.0 255.255.0.0

route outside 0.0.0.0 0.0.0.0 172.31.87.129 1

route inside 172.16.18.0 255.255.255.0 172.18.20.254 1

測試：在ASA 5520上測試：

GX-FW-5520-02(config)# ping 172.31.87.129

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.31.87.129, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

GX-FW-5520-02(config)# ping 172.18.10.62

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.18.10.62, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

結(jié)果是ASA 5520到內(nèi)外都通的。

在我們公司的服務(wù)器上測試看看：

[root@test-lvs02 ~]# ping 172.31.87.129

PING 172.31.87.129 (172.31.87.129) 56(84) bytes of data.

。。。。。。

不通，尼瑪！這是怎么回事？

在我的印象里，這樣配置就可以實(shí)現(xiàn)內(nèi)部訪問外部了。還要做什么配置嗎？哎，老革命遇到新問題，想想辦法吧。

在ASA 5520上啟用debug icmp trace,看到：

GX-FW-5520-02(config)# ICMP echo request from inside:172.18.20.252 to outside:172.31.87.131 ID=25 seq=0 len=72

ICMP echo request translating inside:172.18.20.252/25 to outside:172.31.87.130/7795

ICMP echo reply from outside:172.31.87.129 to inside:172.31.87.130 ID=7795 seq=0 len=72

ICMP echo reply untranslating outside:172.31.87.129/7795 to inside:172.18.20.252/25

ICMP echo request from inside:172.18.20.252 to outside:172.31.87.130 ID=25 seq=1 len=72

ICMP echo request translating inside:172.18.20.252/25 to outside:172.31.87.130/7795

ICMP echo reply from outside:172.31.87.129 to inside:172.31.87.130 ID=7795 seq=1 len=72

ICMP echo reply untranslating outside:172.31.87.130/7795 to inside:172.18.20.252/25

ICMP echo request from inside:172.18.20.252 to outside:172.31.87.129 ID=25 seq=2 len=72

這不是典型的坑爹嘛？回來的ICMP數(shù)據(jù)包被阻止了。cisco啥時(shí)候要對回來的數(shù)據(jù)包做acl了？沒有辦法。添加吧。

access-list from_outside_in extended permit icmp any any

access-group from_outside_in in interface outside

再在內(nèi)部的服務(wù)器上測試。通了。無奈?。?/p>